News

Bot the Likely Culprit for WINS Flaw Activity

There was a flurry of discussion regarding a possible WINS worm due to a spike in WINS port 42 traffic.

The vulnerability arises from a problem with the Microsoft Windows Internet Naming Service. Microsoft posted a patch on Dec. 14 for the flaw, which was unusual in that it was already public. Most Microsoft patches serve as the first indication outside of Microsoft and a single security firm or researcher that the patched flaws exist.

Since the vulnerability is only found in WINS servers, not WINS clients, and since WINS servers are few and far between, we quickly surmised that one or more of the current bots had included the recently published exploit and started scanning for it.

Anyone with such a bot already installed would then emit the attack packets.

A bot is any piece of software which makes a victim system behave like a robot. Once the software is executed, it causes the system to take instructions from the bot owner.

This is typically done via an IRC channel. The bot, when started, registers itself to the bot owner as part of that person's botHerd. A botHerd is simply the name given to a group of similar bots under the control of a single owner, or group of owners.

By establishing an outbound connection to the bot IRC channel, bots can bypass many firewalls or similar controls where outbound traffic is, unfortunately, typically allowed.

Bots are notorious for quickly implementing new vulnerability exploit code, and since the botHerd owners have an established base of attacking systems, the attack can easily look like a worm.

An instruction is issued in the controlling IRC channel and the bots dutifully update themselves with whatever new attacks the bot owner has coded. Then they'll typically resume their activities, be it spamming, attacking or whatever the owner desires.

Russ Cooper is a Senior Information Security Analyst with Cybertrust, Inc., www.cybertrust.com. He's also founder and editor of NTBugtraq, www.ntbugtraq.com, one of the industry's most influential mailing lists dedicated to Microsoft security. One of the world's most- recognized security experts, he's often quoted by major media outlets on security issues.

Russ Cooper's Security Watch column appears every Monday in the Redmond magazine/ENT Security Watch e-mail newsletter. Click here to subscribe.

About the Author

Russ Cooper is a senior information security analyst with Verizon Business, Inc. He's also founder and editor of NTBugtraq, www.ntbugtraq.com, one of the industry's most influential mailing lists dedicated to Microsoft security. One of the world's most-recognized security experts, he's often quoted by major media outlets on security issues.

Featured

  • Microsoft Warns IT Pros on Windows Netlogon Fix Coming Next Month

    Microsoft on Thursday issued a reminder to organizations to ensure that their systems are properly patched for a "Critical"-rated Windows Netlogon vulnerability before next month's "update Tuesday" patch distribution arrives.

  • Microsoft Nudging Skype for Business Users to Teams

    Microsoft on Thursday announced some perks and prods for Skype for Business unified communications users, with the aim of moving them to the Microsoft Teams collaboration service instead.

  • How To Improve Windows 10's Sound and Video Quality

    Windows 10 comes with built-in tools that can help users get the most out of their sound and video hardware.

  • Microsoft Offers More 'Solorigate' Advice Using Microsoft 365 Defender Tools

    Microsoft issued yet another article with advice on how to use its Microsoft 365 Defender suite of tools to protect against "Solorigate" advanced persistent threat types of attacks in a Thursday announcement.

comments powered by Disqus